Add read-only Google Calendar integration via gws CLI

Adds a get_calendar_events agent tool that shells out to `gws calendar +agenda`
for admin users. Controlled by GOOGLE_CALENDAR_ENABLED env var, with OAuth
credentials mounted from credentials.json.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.env.example

@@ -93,6 +93,12 @@ EMAIL_HMAC_SECRET=
 # Set to false to disable Mailgun signature validation in development
 MAILGUN_SIGNATURE_VALIDATION=true
 
+# Google Calendar Configuration (via gws CLI)
+GOOGLE_CALENDAR_ENABLED=true
+# Export credentials: gws auth export --unmasked > credentials.json
+# The file is mounted into the container at /app/config/gws-credentials.json
+GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=/app/config/gws-credentials.json
+
 # Obsidian Configuration (headless sync)
 # Obsidian account credentials (used for `ob login` on container startup)
 OBSIDIAN_EMAIL=your-obsidian-email